Report loading
carousels.in
Preparing the full page inventory and screenshots.
Report loading
Preparing the full page inventory and screenshots.
49 / 100
Poor
0 critical fixes · 4 quick wins
Priority verdict
49/100 - poor. Start with the fixes below before reading the full report.
The biggest issue is http does not redirect to https. Start with the priority fixes, then use the evidence and technical details when a developer needs proof.
Poor
3 priority fixes identified
Score
49 / 100 — Poor
No major launch blockers found.
Biggest risk
HTTP does not redirect to HTTPS
visitor safety and trust
Fastest win
HTTP does not redirect to HTTPS
A practical first fix for your builder or AI agent.
Estimated impact
Higher confidence and discoverability
Fix the priority items first, then re-scan to confirm the evidence.
Biggest area to improve: Security, which mostly means visitor safety and trust.
Priority verdict
This site is technically inspectable, but the priority is making the next fix obvious.
Fix the highest-impact issue first, then use structured evidence and developer prompts so search engines, AI answer engines, and real visitors can understand the site more reliably.
What's working
What needs attention
What to do first
Carousels.in fails to enforce secure connections, leaving users vulnerable to man-in-the-middle attacks because the site does not automatically redirect HTTP traffic to HTTPS. The platform demonstrates a strong foundation in content strategy and AI-readiness. The homepage features a compelling value proposition with a clear visual hierarchy, and the site maintains a healthy text-to-HTML ratio. Crucially, the robots.txt configuration is well-structured for the modern era, providing clear signals to AI crawlers and allowing specific agents like OpenAI's SearchBot to index content for answer-engine discovery. However, the site faces serious security and accessibility gaps that undermine user trust and compliance. The absence of a Content-Security-Policy (CSP) and Strict-Transport-Security (HSTS) header creates high-priority security concerns regarding XSS and protocol downgrade attacks. Furthermore, insufficient color contrast ratios present a high-priority accessibility barrier, potentially excluding users with visual impairments and impacting overall usability. There is a significant opportunity to capture more organic and AI-driven traffic by optimizing technical SEO and performance. Currently, the site lacks a sitemap.xml and JSON-LD structured data, which limits how effectively search engines and AI agents can parse the product's entity. Additionally, resolving performance issues—specifically the 2.3 MB page weight and the lack of responsive image sets—will improve the Largest Contentful Paint (LCP) and ensure a smoother experience for mobile users. To stabilize the platform and protect user data, the following actions must be prioritized in the next 30 days: - Implement a global 301 redirect from HTTP to HTTPS and enable HSTS headers.
Scan details
Checks performed: SEO, UX, accessibility, performance, security, AI search.
Fix workflow
Treat this report as a queue: send the ready fixes, accept any intentional risks, then re-scan the production URL after changes land.
32
Ready to send
47
Not started
0
Accepted risk
0
Re-scan queued
The full report has all the proof. This is the owner-friendly version of what to do first.
Plain-English reason
This affects visitor safety and trust. PageLens marked it as important so you know where it belongs in the queue.
What to ask your builder or AI agent to do
Configure the web server to 301-redirect all HTTP traffic to HTTPS. In Nginx: `return 301 https://$host$request_uri;`
Visiting the HTTP version of the site (http://carousels.in/) does not redirect to HTTPS. Users arriving via HTTP are exposed to man-in-the-middle attacks.
Plain-English reason
This affects visitor safety and trust. PageLens marked it as important so you know where it belongs in the queue.
What to ask your builder or AI agent to do
Add: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
No HSTS header. Users are vulnerable to protocol downgrade attacks.
Plain-English reason
This affects visitor safety and trust. PageLens marked it as important so you know where it belongs in the queue.
What to ask your builder or AI agent to do
Add a Content-Security-Policy header. Start restrictive: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'
No CSP header found. The site is vulnerable to XSS and injection attacks.
A practical roadmap for turning the audit into progress.
Today
Configure the web server to 301-redirect all HTTP traffic to HTTPS. In Nginx: `return 301 https://$host$request_uri;`
This week
Add: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
This month
Add a Content-Security-Policy header. Start restrictive: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'
Same data as the full report, grouped by what a non-technical owner should do with it.
High-impact fixes that should usually be tackled before anything else.
Important fixes that may need more development time or a design decision.
Nothing in this bucket.
Polish and lower-priority work. Useful, but not where to start.
Need the detail?
The full report still has every finding, evidence, rule ID, filters, screenshots, and technical panels.